GHSA-27mw-82g8-phjj

Suggest an improvement
Source
https://github.com/advisories/GHSA-27mw-82g8-phjj
Import Source
https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/10/GHSA-27mw-82g8-phjj/GHSA-27mw-82g8-phjj.json
JSON Data
https://api.osv.dev/v1/vulns/GHSA-27mw-82g8-phjj
Aliases
Published
2026-10-23T20:43:30Z
Modified
2026-10-23T21:00:04Z
Severity
  • 0.0 (None) CVSS_V3 - CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:N CVSS Calculator
Summary
SvelteKit : XSS via untrusted cache-control header in prerendered page
Details

Impact

Applications that prerender pages and use setHeaders to set a cache-control header from an untrusted source are vulnerable to cross-site scripting (XSS).

SvelteKit inserts the header value into a <meta http-equiv="cache-control"> tag without escaping it. An attacker who can influence this value at prerender time can break out of the content attribute and inject HTML or JavaScript into the generated page. The injected code can then execute when users visit the page.

Patches

The fix escapes the header value before inserting it into the generated HTML. Upgrade to @sveltejs/kit version 3.0.0 or later.

Workarounds

Avoid forwarding untrusted cache-control header values with setHeaders on prerendered pages. Use a fixed, trusted cache policy instead.

Database specific 
{
    "cwe_ids":  [
        "CWE-79"
    ],
    "github_reviewed":  true,
    "github_reviewed_at":  "2026-10-23T20:43:30Z",
    "nvd_published_at":  null,
    "severity":  "LOW"
}
References

Affected packages

npm / @sveltejs/kit

Package

Name
@sveltejs/kit
View open source insights on deps.dev
Purl
pkg:npm/%40sveltejs/kit

Affected ranges

Type
SEMVER
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
3.0.0

Database specific

source 
"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/10/GHSA-27mw-82g8-phjj/GHSA-27mw-82g8-phjj.json"